Credit card number stolen at gas pump

Planet Money had a fascinating episode about the market for stolen credit cards.

The CC numbers are stolen either using a skimmer or by hacking into a merchant’s database. They’re then sold on underground websites. Criminals buy batches of numbers and print up duplicate credit cards. They hire people to shop using these cards, and resell the merchandise on Ebay.

I don’t have any technical knowledge with gas station card readers on the pumps.

But I would be very surprised if the gas station employees can ever see your card number. I would be willing to bet your card number goes straight to a central payment processing computer, probably at the merchant services provider contracted by the retailer. There is no reason for the kid inside to ever see your card number. He is just there to sell Slim Jims and Red Bull.

Depends on the register system. Some old ones actually print out a daily list of every credit transaction (with every credit card number) at daybreak. Most newer ones don’t. The popular, yet horrifically poorly designed and implemented ‘Gemstone’ register has no easy way for the cashier to check your numbers via the register screen or software.

It does print a hard copy of them all on a roll of paper for record keeping. You might think this was a security threat. This can, and should, be asterixed out, but often is not, because the system is so unstable and dropps data so often having a hardcopy is often the only way to make sure you get paid when the system crashes.

Your specific register may or may not be asterixed out, depending on how skilled and/or drunk the rep was when he or she installed it. Do not ask to have the setting changed, as the rep will swear on whatever bits of his mother’s is most sainted that there IS no such setting. And if there was, it couldn’t be changed, due to state laws. (Apparently there are very strict laws regarding non-existant software settings) Explaining that you have witnessed the difference at other stores in the same chain with the same hardware will not convince them. Question the rep only at your extreme peril, for you will be at their mercy the next time the software goes down. And they have long memories.

Anyway, said paper roll is in a small plastic case which the cashier could open and check, but that would be pretty obvious on the security tape. One hopes.

The back of the register actually has a plug that will destroy the entire register forever if you pull it out. The extremely expensive register. Which you are likely to do, as it looks like the logical way to hard-reboot the system when it freezes up. It’s not attached to the register in any way, nor is there any kind of warning label. It’s like that ‘wings fall off’ button that planes have, except it really exists.

Right. But after a dozen or so people scream at you for not accepting their unsigned card, or not accepting a spouses card (is that legal? It’s been a few years, I can’t remember) or (god forbid) telling them they aren’t supposed to write ‘please check ID’ many, if not most, minimum wage clerks stop strictly enforcing them.

A minimum purchase for credit cards is against the rules as well, but that dosn’t stop many small businesses from adding them.


A cynical man might suggest that the card companies deliberately set rules that they know won’t be followed, so they can blame the vendors when the inevitable occurs. The fact that this helps them transfer the majority of the risk onto said vendors is, I’m sure, a happy coincidence for them.